This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present invention that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present invention. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.
Elliptic curve cryptography provides high level of security (exponential security) with smaller key size in comparison to the conventional RSA cryptosystem (subexponential security). The applications of ECC are increasing in our everyday lives as more and more people are relying on small electronic devices. The smaller key size makes ECC attractive for constrained devices such as PDAs or smart cards. The efficiency of ECC is dominated by an operation called scalar multiplication (or point multiplication). The problem is, given a point P on an elliptic curve (defined over a finite field or a finite ring) and a scalar k, to generate the point kP, that is, P+ . . . +P(k−1 times) as cost efficiently as possible. This problem is an obvious analogue of the evaluation of powers. Hence, methods of fast evaluation of powers can be used here to get efficient implementations.
The elliptic curve group operations can be expressed in terms of a number of operations in the definition ring. The crucial problem becomes to find the right model to represent an elliptic curve in a way to minimize the number of ring operations. Indeed, as an elliptic curve is defined up to birational transformations, there are plenty of possible choices for its representation. However, in order not to explode the number of coordinates and operations, only models of elliptic curves lying in low-dimensional spaces are considered in practice.
Furthermore, the basic operations involved in point addition formulæ (namely, ring addition/subtraction, ring multiplication, and ring inversion) are not equivalent with each other. In particular, ring inversion requires a special attention as it may significantly impact the overall performance. For cryptographic applications using elliptic curves, typical ratios for inversion over multiplication in the underlying finite ring range from 3 to 30. For that reason, inversion-free point addition formulæ are of particular interest. This is classically achieved by resorting on projective representations (including the widely-used homogeneous and Jacobian coordinates).
Numerous useful forms of elliptic curves using various coordinate systems and their respective costs are compiled in the Explicit-Formulas Database provided by D. Bernstein et al., on the website http://www.hyperelliptic.org/EFD.
When affine coordinates system is used to represent the points of an elliptic curve, there is currently no technique that prevents to use an inversion operation in a finite ring. It is an aim of the present technique to get rid of the ring inversion operation in the evaluation of a scalar multiplication. The proposed technique can of course be applied to another context where only basic operations (addition) are performed between points (as in the verification of the ECDSA algorithm).